# Use of keyword 'else' causes error "Couldn't find any filter plugin named 'else'."

**URL:** <https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988>\
**Category:** Logstash\
**Created:** [December 8, 2018, 12:06am UTC](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988 "2018-12-08T00:06:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![RussellBateman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russellbateman/32/34928_2.png) [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\
**Post date:** [December 8, 2018, 12:06am UTC](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988/1 "2018-12-08T00:06:24Z")

</div>

I have the following code in my filter. The construct, `if ... else if ... else` are described by Logstash documentation as being valid yet _/var/log/logstash/logstash-plain.log_ records this error message.

```
filter
{
  if [source] =~ "debug"
  {
    dissect
    {
      mapping =>
      {
        "message" => "[%{ignore}] %{acme.date} %{acme.time} - REST: Path: %{acme.restpath}"
      }
    }

    if "_dissectfailure" in [tags]
    {
      dissect
      {
        mapping =>
        {
          "message" => "[%{ignore}] %{acme.date} %{acme.time} - REST: Request length: %{acme.requestlength}"
        }
      }
    }
    else ****the error is issued for this else****
    {
      # Now that the new, split-out fields are created, we don't need
      # to keep 'message' any longer:
      remove_field => ["message "]
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [December 14, 2018, 5:15am UTC](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988/2 "2018-12-14T05:15:44Z")

</div>

Hi Russell,

What is the error message? Could you please post the same?

> [@RussellBateman](#):
>
> if [source] =~ "debug"

Do you intend this to be a regex match? The correct operator to use for equality check would be `==`.

Also, to troubleshoot, if the message is going through a conditional, you can try using the `add_tag` option for logstash filter.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 14, 2018, 6:50am UTC](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988/3 "2018-12-14T06:50:59Z")

</div>

The last `remove_field` can not stand on its own but should be part of a filter config e.g. a mutate filter.

---

<div class="post-metadata">

**Author:** ![RussellBateman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russellbateman/32/34928_2.png) [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\
**Post date:** [December 14, 2018, 3:28pm UTC](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988/4 "2018-12-14T15:28:15Z")

</div>

Thanks hugely for the replies, my friends!

First, `if [source] =~ "debug"` will be matching strings like "/var/log/acme/debug.log". I'm handling piles of logs on many different paths, but some log-types, like our own _debug.log_, are predictable and can be filtered the same. So, yeah, regular expression matching was my intention. (Took me a long time before figuring out that these filters were Ruby-esque; wish Elastic documentation had said that up front.)

(The error was in _/var/log/logstash/logstash-plain.log_ and contained the text of this issue's subject along with much of the code originally posted.)

I'll look into `add_tag`.

Second, and this goes for `add_tag` too, your comment is welcome. I simply had never thought that `remove_field` must be embedded in a filter because, here I thought, I am embedding it in a filter--my filter, that starts out with the keyword `filter`. I am armed with new understanding!

Most of Elastic's and even others' examples of filter writing are short, succinct and I struggle to connect the dots between the features.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2019, 3:28pm UTC](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988/5 "2019-01-11T15:28:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.